Patona Digital Pty Ltd (ABN 92 654 805 437) trading as teamified ("teamified", "we", "us", "our")
Last updated: October 2026
Version 1.0
1. Purpose and Scope
This Privacy Policy explains how teamified collects, uses, discloses and protects personal information across our websites (teamified.com, teamified.com.au), the teamified platform and product suite (Alexia, HRIS, ATS, Team Connect, Jobseeker Portal), and our services (Managed Recruitment, the Self-Serve Platform and Employer of Record (EOR) services).
It applies to clients and their authorised users, employees managed through our HRIS or EOR services, candidates, jobseekers, website visitors, and anyone who contacts us. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and the laws identified in Section 15.
2. Our Role
| Role | When | Examples |
|---|---|---|
| APP entity / controller | Information we collect for our own purposes | Website visitors, account registration, marketing, Jobseeker Portal accounts, EOR employment records we hold as employer, candidates we source into our own talent pool before they are put forward to a client, and client account and billing information |
| Processor / service provider | Information clients submit to the Platform or to us, or that we generate for a client's role | Employee data in HRIS, candidate data in ATS, Client Data on the Self-Serve Platform, role and engagement information a client provides to open or fill a role, and candidate information from the point a candidate is put forward for a client's role |
Where we process personal information on a client's behalf, that processing is governed by the agreement under which we provide the relevant product or service, and the client is responsible for its own privacy notices and any required consents. A candidate we source may move from one role to the other: we hold their information in our talent pool for our own recruitment purposes, and once we put them forward for a client's role, the information relating to that role is held for the client.
3. Information We Collect
Directly from you: name, contact details, company and role, billing and payment information, authentication credentials (hashed), communications and support requests, documents and content you upload.
From client organisations: organisation and billing details, authorised user and contact details, and role and engagement information (position descriptions, assessment criteria, salary or rate bands, hiring manager and panel details). Where role information identifies an individual, or an organisation is a sole trader or partnership, we treat it as personal information under this Policy.
Through Platform use:
Alexia: conversation history, queries, documents submitted for AI analysis, AI outputs, voice recordings where voice features are used
HRIS / EOR: personal and employment details, compensation, leave, performance, bank and tax details, visa and work rights, and sensitive information where lawfully collected
ATS / Managed Recruitment: candidate applications, resumes, work history, qualifications, assessments, interview responses, notes and recordings (made with consent), references, right-to-work documentation, voluntarily provided diversity data; client-generated information about candidates (feedback, ratings, progression decisions, reasons for rejection); role and workflow configuration; and audit logs of user activity
Jobseeker Portal: profile, preferences, applications, job search activity
Team Connect: messages, files, meeting recordings and transcripts (with participant consent), presence data
Identity verification information. Where identity verification is required, we collect copies of government-issued identity documents (such as a passport or driver licence) and the details on them, and a facial image or short video which is compared to the document photo to confirm you are the document holder. The facial image and any template derived from it is biometric information, which is sensitive information under the Privacy Act. We only collect it with your express consent, given at the time of verification, and only where verification is needed for the service you have requested. If you do not consent, we will offer an alternative verification method where one is reasonably available.
Automatically: usage data, device and technical information (IP address, browser, device identifiers), and cookies (Section 9).
From third parties: integrations you authorise, SSO providers, and publicly available professional information.
4. How We Use and Share Your Information
We use personal information to provide and operate the Website, Platform and services; deliver recruitment and EOR services; power AI features (Section 6); process payments; provide support; secure our systems and prevent fraud and abuse; comply with legal obligations; improve our products using aggregated, de-identified data; and, with consent or as permitted by law, send marketing communications.
We collect and use personal information where it is reasonably necessary for our functions or activities, where you consent, or where required or authorised by law. Sensitive information is collected only with explicit consent or where otherwise permitted by law.
Identity verification information, including biometric information is used only to verify your identity and to detect fraud. It is not used for any other purpose, and is not used to train AI models.
We do not sell, rent or trade personal information, and we do not use personal information for third-party advertising.
We share information with:
Service providers and sub-processors who help us operate, including cloud infrastructure, AI model providers, payment processing, email delivery, analytics, support and security. All are bound by contractual obligations to protect personal information and use it only for specified purposes. Our current list of sub-processors and processing locations is available on request.
Client organisations. Authorised users access information according to permissions the client controls. We disclose to candidates only what is necessary for them to consider and progress in a role; we do not disclose internal role information unless the client instructs us to.
Integrations you connect, as necessary to enable them. You can disconnect at any time.
Legal and compliance recipients where required by law, to protect rights, property or safety, or to detect and prevent fraud or security issues. Where permitted, we will notify you.
Business transfers. If we are involved in a merger, acquisition, restructure, financing, or sale of all or part of our business or assets, personal information may be disclosed to prospective and actual acquirers and their professional advisers to evaluate or complete the transaction, and may transfer as part of it. Recipients must keep the information confidential and use it only for that purpose. Transferred information remains subject to this Policy until the acquiring entity notifies you of any different privacy practices.
Aggregated data that cannot reasonably identify individuals.
5. Data Security
We maintain an information security management system aligned to ISO/IEC 27001, including encryption in transit and at rest, role-based access control with multi-factor authentication, security monitoring and logging, regular vulnerability testing, and personnel screening and training. Details of our security controls are available in schedule 4.
Data breaches. We assess and notify data breaches in accordance with the Notifiable Data Breaches scheme under the Privacy Act, and notify affected clients in accordance with our agreements with them.
6. Artificial Intelligence and Automated Decisions
We maintain AI governance aligned to ISO/IEC 42001, covering risk assessment, human oversight, data governance for model development and post-deployment monitoring.
What our AI does. Our AI features assist with sourcing, screening, AI interviewing, candidate scoring, document analysis, summaries, insights and workflow automation.
A human always decides. AI outputs are advisory inputs to a human decision. No AI output constitutes an employment or engagement decision, and the Platform is designed for human review of AI outputs before any employment decision is made. Clients must not use the Platform to make employment decisions solely by automated means without meaningful human review.
Automated decisions (APPs 1.7 to 1.9). We use computer programs, including AI models, to make or substantially assist in making some decisions where personal information is used and the decision could reasonably be expected to significantly affect an individual's rights or interests:
| Kind of decision | Made by | Kinds of personal information used |
|---|---|---|
| Whether a candidate in our talent pool is put forward to a client for a role | teamified, with human review before any candidate is put forward | Application details, resume and work history, qualifications, skills, location and work rights, assessment and interview responses |
| Which roles are surfaced or recommended to a jobseeker | teamified | Profile details, skills, experience, location, stated preferences and platform activity |
| Whether an account or organisation is restricted or suspended for suspected misuse, fraud or security reasons | teamified, with human review of the outcome and an appeal path | Account and identity details, authentication and device data, usage and access logs, and the content or conduct giving rise to the signal |
| Whether a submitted identity or verification document is accepted, flagged or referred for manual check | teamified, with human review before rejection | Identity documents and the information they contain, verification signals, facial image and biometric comparison result |
| Ranking, scoring or filtering of candidates against a role within the Platform | The client, using our tools | As configured by the client from the categories in Section 3 |
Where a client uses the Platform to rank, score, filter or assess candidates, the client decides the criteria, decides the outcome and is the entity making that decision. We supply the functionality.
Not all of our services involve automated or AI-assisted processing; whether the decisions above apply to an engagement depends on the services contracted and the features enabled. Where we make a decision of the kinds listed above, an individual may ask for the outcome to be reviewed by a person. We will tell you how to do this at the time. You can also contact privacy@teamified.com.au.
No training on your data. We do not use client data or candidate personal information to train models made available to other clients, except in de-identified and aggregated form, unless the client expressly consents in writing. Third-party AI providers are contractually prohibited from using your data to train their models.
Records. We retain the criteria, inputs, outputs, model version and human-review record for automated decisions for the periods in Section 7, so decisions can be reviewed or explained.
Client obligations. Clients deploying our AI functionality are responsible for determining whether bias audit, impact assessment, registration or notice obligations apply in their jurisdictions (including NYC Local Law 144, the Colorado Artificial Intelligence Act and the EU AI Act) and for providing candidates with legally required notices. We supply documentation to support these obligations.
7. Data Retention
| Category | Retention period |
|---|---|
| EOR employment records (teamified is the employer) | 7 years from end of employment (statutory). Not client-directed |
| Client HRIS employee data | Client-directed during the subscription; deleted 90 days after the subscription ends unless agreed in writing |
| Managed Recruitment candidates | 24 months from last interaction |
| Client ATS candidates | Client-directed during the subscription; deleted 90 days after the subscription ends unless agreed in writing |
| Jobseeker Portal profiles | Until account deleted, or 24 months of inactivity |
| Alexia conversation history, uploaded documents and AI outputs | Until deleted by the user or the account is deleted |
| Identity verification and biometric information | Retained while the account or engagement is active; deleted 90 days after relationship ends unless agreed in writing |
| Automated decision records | Minimum 24 months |
| Account, billing and payment records | Duration of account; billing records 7 years (legal requirement) |
| Team Connect messages | Per client retention settings |
| Google user data (cached) | Deleted within 30 days of disconnecting the integration |
Client-directed periods apply within the maximums above. Records we must keep by law, information under legal hold or relating to an actual or anticipated legal proceeding, and automated decision records are retained for the periods stated above regardless of client direction.
8. International Data Transfers
Primary data storage is in Australia. We operate globally, and personal information may be processed in the locations in which we and our approved sub-processors operate, as set out in our current list of processing locations and sub-processors, available on request.
9. Cookies and Tracking
We use cookies and similar technologies for authentication, security and session management (essential), preferences (functional, up to 1 year) and aggregated usage statistics (analytics, up to 1 year). We do not use cross-site tracking cookies or third-party advertising cookies. You can manage cookies through your browser settings; disabling essential cookies may affect functionality.
10. Your Privacy Rights
You can access and correct your personal information, request deletion (subject to legal retention), request your data in a machine-readable format, object to direct marketing, withdraw consent, and complain if you believe we have breached the Privacy Act.
How: self-service through your account settings (including Alexia account deletion via Settings, Security, Delete Account), or email privacy@teamified.com.au. We respond within 30 days and may need to verify your identity.
Employee and candidate data held for a client: your employer or the recruiting organisation controls that information. Direct requests to them first; we will assist them to respond, or coordinate with them if you contact us directly.
Complaints: Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au, 1300 363 992.
11. Third-Party Integrations
When you connect third-party integrations, we access and share information only as necessary to provide the features you enable. Disconnecting an integration revokes access.
Google Workspace. When you connect a Google account to Alexia, we access Google user data only to provide features you explicitly enable. Scopes: gmail.modify (triage, summarise, draft and send approved replies on your instruction); calendar.readonly and calendar.events (scheduling context and event management on your instruction); openid, userinfo.email, userinfo.profile (account identification). Alexia's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising or to train AI/ML models. Where Google user data is sent to LLM providers solely to generate a response for you, those providers are contractually bound to zero data retention and no training on your content. Cached Google data is deleted within 30 days of disconnecting; you can also revoke access at myaccount.google.com/permissions.
Identity verification is performed by a third-party verification provider acting on our behalf. We require the provider to delete the biometric data once verification is complete, and to hold it under contractual protections consistent with the Australian Privacy Principles.
12. Children's Privacy
The Platform and Website are not intended for individuals under 18. We do not knowingly collect personal information from children, and will delete it promptly if identified.
13. Marketing
Transactional communications (account, security, service notices) cannot be opted out of. Marketing communications can be opted out of via account settings, unsubscribe links, or privacy@teamified.com.au. We do not share your information with third parties for their marketing.
14. Changes to This Policy
We may update this Policy to reflect changes to our practices, products or the law. We will post updates with a revised "Last updated" date. Previous versions are available on request.
15. Jurisdiction-Specific Information
EU / UK (GDPR). Additional rights include portability, erasure, restriction, objection to automated decision-making and complaint to a supervisory authority. Legal bases: contract performance, legitimate interests, legal obligations, consent.
United States. California residents have rights under the CCPA/CPRA to know, delete, opt out of sale or sharing (we do not sell or share personal information as defined) and non-discrimination. Where we process personal information for clients subject to US state privacy laws, we act as a service provider/processor.
New Zealand. This Policy is intended to comply with the Privacy Act 2020 (NZ).
Philippines. Where personal information is processed in or from the Philippines, we comply with the Data Privacy Act of 2012.
India. Where personal information is processed in or from India, we comply with applicable Indian data protection law, including the Digital Personal Data Protection Act 2023 as it takes effect.
16. Contact Us
Privacy Officer, teamified, Melbourne, Victoria, Australia.
Email: privacy@teamified.com.au | General: support@teamified.com.au | Legal: legal@teamified.com.au
Labour hire licence VICLHL10150 (Labour Hire Licensing Act 2018 (Vic))